FBI Probe Reveals North Korean IT Contractor Worked for US Federal Agency, Raising Hiring Questions

The FBI is investigating how a North Korean remote IT worker came to work for an unidentified US federal agency, after the bureau discovered the individual in July 2026. The case has raised fresh questions about how North Korean operatives are getting through hiring and identity checks designed to prevent them from accessing US organisations.

The discovery was disclosed by Todd Hemmen, deputy assistant director of the FBI's Cyber Capabilities Branch, during a Digital Government Institute conference in Washington, DC, on 28 July.

Hemmen said investigators had identified a Democratic People's Republic of Korea remote IT worker who had been working for the federal government, although he gave no details about the agency or the person involved.

FBI Investigation Shows a Growing North Korean IT Threat

The FBI has been warning for years that North Korea sends skilled IT workers overseas to obtain legitimate employment under false identities. The workers can then earn money for the regime, while potentially gaining access to corporate networks and sensitive information.

The scheme has become increasingly sophisticated. US authorities say North Korean workers have used stolen identities, false documents, virtual private networks and remote-access tools to disguise where they are actually working from. In some cases, US-based facilitators have helped receive company laptops or create the appearance that an overseas worker is physically located in America.

The FBI has also warned that the threat is no longer limited to collecting salaries. Investigators have found cases in which workers used their access to steal proprietary information, credentials and other sensitive data, sometimes followed by extortion attempts.

Artificial intelligence is adding another layer to the problem. Hemmen said during the July conference that AI was being used across the recruitment process, including for creating CVs and identity documents, taking part in video interviews and generating convincing deepfakes.

'We're seeing AI use across that entire spectrum of the DPRK remote worker, from application to employment,' Hemmen said.

That matters because a remote IT position can appear relatively ordinary on paper. The person may not hold a security clearance or occupy a high-profile government role, yet still have access to systems that connect to major government infrastructure.

Concerns Mount Over Federal Hiring Process

Hemmen described the particular case as 'a little bit baffling', saying he did not understand how the agency's process had allowed the worker to get through.

The FBI has declined to provide further details. It remains unclear which federal agency was involved, how long the individual worked there, what systems the person could access or whether any sensitive information was taken. Those gaps are important, because the discovery alone does not establish that classified information was compromised.

It is also unclear from the information released publicly whether the worker was a direct federal employee or was working through a contractor or subcontractor. Experts cited by Federal News Network said the latter is considered more likely because federal employees and many contractors face extensive identity and background checks.

There is, however, a documented precedent for North Korean IT workers reaching government-related environments.

Last year, a Maryland man was sentenced to 15 months in prison after helping a North Korean national in China obtain software development work. The Justice Department said the scheme involved at least 13 US companies, some of which provided services to US government agencies, including the Federal Aviation Administration. Co-conspirators subsequently gained access to sensitive government systems from China.

The case illustrates why investigators are examining the federal incident so closely. The issue may not necessarily be a failure at the point where an agency directly hires someone. Contractors, staffing firms and subcontractors can create additional layers between the government and the person actually performing the work.

Donald Blersch, a former senior government official who advises risk assessment firm Clearspeed, warned that workers in support roles can still create a route into sensitive environments.

'When those individuals aren't vetted in a way comparable to the access they are given, you're potentially hiring a Trojan horse,' Blersch said.

The concern has now spread beyond a single agency. On 31 July, US authorities and more than a dozen international partners issued a global alert warning governments, businesses and individuals about North Korean remote IT workers.

A recent Intelligence and National Security Alliance paper has also called for stronger identity verification for support workers who may not undergo the same scrutiny as people holding security clearances.

For now, the FBI investigation has left one central question unanswered: how did a North Korean operative manage to get far enough through the federal hiring process to begin working inside a US government environment in the first place.